Circleback vs tl;dv

Circleback 78

@circleback/cli 1.2.1 published on 3 November 2026 and a release entry on 2 November (30). Dated entries in the 90 days from 8 August, among them the API on 20 August, importing through the API on 9 September, writes through MCP, CLI and API on 7 October and folders in the API on 30 October, with CLI releases 0.9.0 to 1.2.1 since 6 October (20). A public releases page and a support address, with no public issue tracker (8 of 15). In the official MCP registry as ai.circleback/circleback (15). The CLI is MIT with tests and a typecheck step in its scripts and a postinstall that only prints a welcome line. Its repository isn't public (5 of 10). 30+20+8+15+5 = 78.

tl;dv 28

The API docs carried no dates on 8 October and were not re-read on 4 November. The newest dated change is still the README commit of 29 September 2026 describing the hosted MCP server, 36 days before this check, with code commits last made on 12 December 2025, per a clone on 4 November (20). No dated releases or changelog entries in the 90 days from 6 August 2026 (0). No public changelog. Support is by email and in-app chat. On 8 October five pull requests were open with no reply and a licence question from 22 October 2025 was unanswered. GitHub's pages answered 403 on 4 November, so this is not re-read (5). No official SDK. Presence in the official MCP registry was read on 8 October through its API, which this check no longer calls, so the line rests on the SDK reading (0). The local server has a GitLab CI file and depends on @modelcontextprotocol/sdk ^1.8.0, and the README says it is not updated regularly (3). 20+0+5+0+3 = 28.

Circleback 77

Graded on the hosted REST API and MCP server with the hosted lines. incident.io status page at status.circleback.ai with four components, none of them the API (20). Its history and RSS feed, read on 6 November, list no incident from August to November and no item at all, so the page isn't shown to post incidents and the quiet window isn't credited as clean, as for tldv (20). Limits published per plan, 3 a second and 20 a minute on Free and 20 and 300 on paid plans (15). 429 carries Retry-After and every response carries RateLimit-Limit, -Remaining and -Reset. No idempotency key or safe-retry guidance for writes (12 of 15). No SLA found in the Terms or on the pricing page (0). The API has no beta label (10). 20+20+15+12+0+10 = 77.

tl;dv 50

Graded on the hosted REST API and the hosted MCP server, with the hosted lines. Instatus page at tldv.instatus.com with eight components, among them Public API and Webhooks & integrations, each at 100.0% for the 90 days to 4 November 2026 (20). Its incident feed still has no entry after 17 November 2022 (21 entries from 21 July 2021), so the page isn't shown to post incidents and the quiet window isn't credited as a clean record, as for kiwi-mcp and together-fine-tuning (20). No request rate limit is published, per the 8 October check of doc.tldv.io, not re-read on 4 November because tl;dv's terms bar crawling its websites. The docs give page size and result caps and mention a daily import quota without a number (0). 429 is documented only on the beta upload, with no Retry-After or backoff guidance. The upload complete call is documented as safe to retry, and webhooks retry after a 10-second wait, per the 8 October check (5). No SLA in the terms of 18 May 2026, re-read on 4 November, which disclaim availability warranties (0). The REST API is labelled v1alpha1 with changes expected. The hosted MCP server carries no beta label, so half credit (5). 20+20+0+5+0+5 = 50.

Circleback 81

Each reference page embeds the OpenAPI 3.2 operation for its endpoint, but no single spec file is linked, and MCP input schemas need a sign-in (20 of 25). llms.txt and a Markdown copy of each docs page (10). Operation descriptions state what is returned and who may act, such as only the owner deleting a meeting, and the update call explains replace semantics (16 of 20). Typed parameters with enums and defaults, such as ownership All, Mine or Shared (13 of 15). curl examples, a JSON error envelope with error and code, and 400 and 429 responses per operation (12 of 15). Paths carry no version, and a public releases page dates each entry (10 of 15). 20+10+16+13+12+10 = 81.

tl;dv 66

Per the 8 October check, not re-read on 4 November because tl;dv's terms bar crawling its websites. A public OpenAPI 3.0.0 description is embedded in doc.tldv.io with a download button, covering 12 operations and two webhook payloads. Hosted MCP tool schemas need an OAuth session, which we did not have (25). tldv.io/llms.txt exists but indexes marketing pages and blog posts, and no Markdown API docs were found (3). The API reference explains plan gating, ownership and the upload flow. The local MCP tool descriptions are one or two sentences with no guidance on when not to use a tool (10). Enums, patterns, length limits and required fields are set on inputs, and metadata is a constrained flat object (12). Request and response samples per operation and two documented error formats with examples. 429 and 403 causes are thinly described (11). The version sits in the path, but no changelog was found (5). 25+3+10+12+11+5 = 66.

Circleback 30

No x402, MPP or L402 (0). Seat prices are public, $15 and $25 a user a month, with nothing priced per call (10). The Free plan includes API, MCP and CLI access with 30 days of history and costs nothing. A card isn't mentioned for it (20). A person signs up in a browser and creates a key or approves OAuth (0). 0+10+20+0 = 30.

tl;dv 15

No x402, MPP or L402 (0). Per the 8 October check, plans are public on a pricing page that renders in the browser, and the help centre gives paid plans as starting at $18 a month. Nothing is priced per call (10). A Free plan exists, and the app's pricing text says no credit card is required, but the Free plan excludes the API, webhooks and MCP, so partial credit (5). A person signs up in a browser, pays for a plan and creates a key or approves an OAuth screen (0). 0+10+5+0 = 15.

Circleback 61

OAuth with dynamic client registration and two scopes on MCP, and API keys that are read-only or read and write, shown once (28 of 30). Read-only keys and a read-only MCP scope, and only an owner can delete a meeting. No confirmation step on the API for shares or deletes (14 of 20). Transcripts, notes and emails are participant-written text, and no prompt-injection guidance was found (0). A usage dashboard for workspace admins and meeting access requests, with no audit log of API or MCP calls found (4 of 15). SOC 2 Type II, EU-U.S. Data Privacy Framework certification, HIPAA, an external penetration test report on the security portal and a valid security.txt. No bug bounty found (15 of 20). 28+14+0+4+15 = 61.

tl;dv 49

The hosted MCP server uses OAuth with PKCE S256, one scope and five-minute access tokens per the README, revocable from the account. The REST API uses one unscoped key per user in a header, with no rotation or expiry documented (22). Both MCP servers are read-only, admins can block MCP through integration policies, and access follows the user's library permissions. The API key cannot be limited to read-only and can import media (14). Transcripts and notes are text spoken by meeting participants, and no prompt-injection guidance was found (0). No audit log or per-call record for API or MCP use was found (0). Per the 8 October check of the security page and trust centre, not re-read on 4 November because tl;dv's terms bar crawling its websites. SOC 2 Type II, a vulnerability report address with a stated 24-hour response, and a Vanta trust centre. No security.txt and no bug bounty found. The README says the API and MCP endpoint are in penetration test scope (13). 22+14+0+0+13 = 49.

Circleback 70

Closed service with clear terms, effective 7 April 2026, naming Circleback AI, Inc. under Delaware law (15 of 30). The security page says customer data isn't used to train models, retention settings are documented per data type with permanent deletion, the Terms delete data when an account is deleted, and a DPA and BAA are published. The Privacy Policy dates from 15 July 2024 and gives no periods (22 of 30). No deprecation policy or dated deprecation notice found (0 of 20). US processing under the Data Privacy Framework is stated. Sub-processors weren't found outside the DPA, which wasn't read in full (10 of 20). 15+22+0+10 = 47.

tl;dv 65

Closed service with published Terms of Service, effective 18 May 2026 and unchanged on 4 November. The local MCP repository is public with no licence file (15). Per the 8 October check, not re-read on 4 November, the privacy policy of 9 September 2026 gives retention per data type (Free recordings three months, paid until account deletion, logs 10 days) and states customer content is not used to train models, which agrees with the security page. The DPA was not found at a public URL (22). No deprecation policy. The highlights endpoint is marked deprecated with no removal date, and the help centre says endpoint changes will be announced in advance (5). The privacy policy names sub-processors by category, among them Google Cloud, Hetzner, Wasabi, Anthropic, AssemblyAI and ElevenLabs, and states EU hosting with AI processing in the EU or US by account setting (16). 15+22+5+16 = 58.